Supporting Secure Embedded Access Control Policy with XACML+XML Security

Abstract

XACML has become the de facto standard for expressing access control policy. Similarly, XML security standards, such as XML encryption and XML digital signature, have been widely deployed for protecting the confidentiality, authenticity and integrity of digital information. In this paper we present a framework of using XACML and XML security to support secure, embedded and fine-grained access control policy. The basic idea is to extend XACML such that access control policy can be embedded with the digital content in the same XACML document. The original content can be further divided into multiple parts, each of which is encapsulated by its own access control policy. The integrated XACML policy and content document is further protected using XML encryption and digital signature. This framework and associated security methods are designed to facilitate the protection, management and sharing of sensitive information.

A novel policy-driven reversible anonymisation scheme for XML-based services

“…Future Work Implementing and testing time-based data expiry using the Smartcard-based solution is left for future work. More research is also needed on how to protect the XACML policies themselves, for example using XML encryption as proposed in [9]. Implementing support for role-based instead of user-based authorisation is also left as future work.…”

Access control for healthcare data using extended XACML-SRBAC model

“…In addition, the original content can be further divided into multiple parts, each of which encapsulated by its own access control policy, to provide finer grained access control. Since then, we have incorporated XML encryption and XML signature into the XACML policy document to further protect the confidentiality, authenticity, and integrity of the content and the access control policy, both embedded in the same XACML document and both can be sensitive information [7]. Many models have been suggested to extend the Role-based access control (RBAC) model to provide location aware access control.…”

“…In [3], the XML-based security standards will be used more and more in terms of an integrated security system, and the possible interaction of different standards was a basic goal in the evolution of XML-based security standards that include XACML and XML Security. The combined use of XACML, XML-ENC, and XML-DSIG in [7] is one more example of constructing an integrated security system focusing on secure, embedded, and fine-grained access control.…”

“…The third XACML logical function, Policy Administration Point (PAP), is an entity that creates and manages access control policies. In a typical XACML usage scenario, a subject (e.g., user, application, or process) wants to take some action on a particular resource [2], [7]. The request is the XACML code corresponding to the access request made by the subject to a certain resource.…”

“…In [6], the policy embedding approach that we use is similar to that of the Enterprise Rights Management (ERM) which is defined as a digital document-based security model that enforces access, usage, confidentiality, and storage policies. However, the method in [7] is based on XACML which is an open standard; while ERM is built upon Microsofts generally proprietary Windows Rights Management Services (RMS) technology that works with RMS-enabled applications to help safeguard digital information from unauthorized use. In [3], the XML-based security standards will be used more and more in terms of an integrated security system, and the possible interaction of different standards was a basic goal in the evolution of XML-based security standards that include XACML and XML Security.…”